A Python-based security code scanner that helps identify potential security vulnerabilities in your codebase. This tool performs automated scanning to detect common security issues, hardcoded secrets, and potential vulnerabilities while generating comprehensive HTML reports with solutions.

• 🔑 Hardcoded secrets and API keys
• 🌐 Insecure protocols (HTTP)
• 💉 SQL injection vulnerabilities
• 🐛 Debug mode configurations
• 🔓 Unsafe CORS settings
• 🖥️ Hardcoded IP addresses
• 🎟️ JWT tokens in code

• 📂 Excludes common build directories (node_modules, .next, etc.)
• 🖼️ Skips binary and asset files
• ❌ Reduces false positives
• 🎯 Intelligent pattern matching

• 📊 Severity-based classification
• 📍 Precise file and line locations
• 💻 Actual code snippets
• 🛠️ Recommended solutions
• ✅ Best practices guidance

• Python 3.7 or higher
• pip (Python package installer)

1. Clone the repository:

   git clone https://github.com/yourusername/security-code-scanner.git
   cd security-code-scanner

2. Install required packages:

   pip install jinja2

python security_scanner.py

   from security_scanner import SecurityScanner
   scanner = SecurityScanner(root_dir="path/to/your/project")
   scanner.scan_directory()
   scanner.generate_report()

• Python (.py)
• JavaScript (.js, .jsx)
• TypeScript (.ts, .tsx)
• HTML (.html)
• Environment files (.env)
• Configuration files (.json, .yml, .yaml, .xml)
• Text files (.txt)

The scanner automatically skips:

• node_modules
• .next
• .git
• pycache
• venv/env
• build/dist
• coverage
• public/assets/images
• And more...

The generated HTML report includes:

• Total issues found
• Severity distribution
• Scan timestamp

• Issue type and severity
• File location and line number
• Problematic code snippet
• Recommended solutions

scanner.patterns['Custom Issue'] = r'your-regex-pattern'

scanner.exclude_folders.add('your-custom-folder')

scanner.allowed_extensions.add('.custom-extension')

We welcome contributions! Here's how you can help:

• Fork the repository
• Create your feature branch

  git checkout -b feature/AmazingFeature

• Commit your changes

  git commit -m 'Add some AmazingFeature'

• Push to the branch

  git push origin feature/AmazingFeature

• Open a Pull Request

This project is licensed under the MIT License - see the LICENSE file for details.

• 1.0.0
  • Initial Release
  • Basic security scanning functionality
  • HTML report generation

• Add support for more programming languages
• Implement custom rule creation
• Add CI/CD integration
• Create a web interface
• Add automated fix suggestions
• Implement severity score calculation

This tool is provided as-is without any warranties. While it helps identify potential security issues, it should not be relied upon as the sole security measure. Always perform thorough security reviews and testing.

- Mukesh Kumar
- GitHub: @mukesh6374
- LinkedIn: https://www.linkedin.com/in/mukesh11

If you found this project helpful, please give it a star! ⭐ For support:

• Open an issue